Privacy policy

Last updated 16 October 2026.

Alex Chadwick, an individual doing business as Chadwick Labs makes VMBridge. This page says what the app and this website do with information. It is not Parallels Desktop's privacy policy.

The app runs on your Mac

VMBridge runs locally. It talks to virtual machines that Parallels Desktop is already running on that Mac. The app source does not include an analytics product, a telemetry pipeline, or a crash reporter. It does not send screenshots, commands, files, or a usage log to Chadwick Labs.

License validation

Activating, validating, or deactivating a license key contacts Polar's API. That request is how the app checks the key. It is not a usage report. After a successful check, the app can keep working offline for 14 days.

Polar (Polar Software, Inc.) is the merchant of record for a purchase. Polar's privacy policy covers the checkout page, the payment, and the customer record Polar keeps: polar.sh/legal/privacy.

What stays on the Mac

• The trial start and the license record are stored under ~/Library/Application Support/VMBridge, or in the folder named by VMBRIDGE_HOME. The copies are license.json, a hidden trial marker in that folder, and the preference date VMBridgeTrialStartedAt. An older "Parallels Pro MCP" folder is reused when it is the only copy, so a rename does not reset the trial. The license file is not stored in the login Keychain.
• A guest sign-in password is stored in signin-passwords.json in that same folder. Tools do not return that password. The activity log records that a sign-in ran, not the secret.
• The activity log records tool calls on the Mac. Typed text and passwords are not written into it. Command lines are, so keep secrets out of commands.
• Files an agent sends to the Mac land in ~/Downloads/From VMs.

Other network requests

Creating a Linux or macOS guest can download an image from that distribution's publisher, or an IPSW from Apple, because that is how vm_create obtains install media. That download is the guest image, not an account with Chadwick Labs.

A build that includes the Sparkle update framework checks this site's appcast for a newer version. A build without Sparkle does not make that check. The check looks up an update. It is not a usage report.

This website is a set of static files. It does not set a cookie and it does not load a third-party script. The theme button stores light or dark in localStorage on your computer. The buy button is a link that leaves this site and opens Polar.

Inside a virtual machine

An agent running inside a guest uses a token that the daemon accepts only from that VM's addresses. The daemon listens on 127.0.0.1 and on the Parallels Shared and Host-Only networks. It does not listen on every interface unless you set that bind address yourself.

Contact

Questions about this policy: chadwickalex@icloud.com.